Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Upgrade
spin
crate to patch a vulnerability. (#8320)
The vulnerability: ``` $ ./build-support/bin/ci.py --cargo-audit ... error: Vulnerable crates found! ID: RUSTSEC-2019-0013 Crate: spin Version: 0.5.1 Date: 2019-08-27 URL: mvdnes/spin-rs#65 Title: Wrong memory orderings in RwLock potentially violates mutual exclusion Solution: upgrade to: >= 0.5.2 error: 1 vulnerability found! Cargo audit failure ``` Although we don't directly depend on `spin`, we depend on `lazy_static` (amongst others) which does: ``` $ (cd src/rust/engine && ../../../build-support/bin/native/cargo tree -p spin -i) spin v0.5.2 ├── lazy_static v1.3.0 ... ``` So this change was generated with a targeted upgrade: ``` $ ./build-support/bin/native/cargo update --manifest-path src/rust/engine/Cargo.toml -p spin --aggressive ```
- Loading branch information